AWS Solutions Architect

Most breaches start with access that was too wide. You work with IAM users, groups, roles and policies, set up multi-factor and federated sign-in, and control many accounts from one place.

• IAM users, groups, roles and policies
• Reading and writing policy documents
• Least privilege in practice
• Multi-factor authentication and federation
• Multiple accounts with Organizations and service control policies
• Temporary credentials and role assumption

You build An IAM design with roles for developers, auditors and an application.

Application security is layered. You place workloads in the right network tiers, filter traffic with security groups and network ACLs, protect web applications and detect threats.

• Public and private subnets
• Security groups versus network ACLs
• Web protection with WAF and Shield
• Threat detection with GuardDuty
• Application secrets and configuration
• Private access to AWS services with endpoints

You build A three-tier network layout with security groups, endpoints and web protection.

Data needs protection while it moves, while it rests and while it ages. You apply encryption with KMS, secure transport, backups and retention, and use compliance tooling to show the controls are in place.

• Encryption at rest with KMS
• Encryption in transit and certificates with ACM
• S3 bucket policies, Block Public Access and Object Lock
• Backups and retention with AWS Backup
• Auditing with CloudTrail and Config
• Compliance reports and shared responsibility

You build A data protection plan for an application that stores customer files and records.

Systems that call each other directly fail together. You separate components with queues, topics and events, scale them independently, and compare servers, containers and functions for each part.

• Queues, topics and event buses: SQS, SNS and EventBridge
• Load balancing and Auto Scaling
• Serverless with Lambda and API Gateway
• Containers on ECS and EKS at a design level
• Stateless design and session handling
• Decoupling a tightly coupled application

You build A redesign that replaces direct calls between two services with a queue and scaling rules.

Everything fails eventually, so design for it. You spread resources across zones and Regions, use managed failover for databases and DNS, and pick a disaster recovery approach that matches the recovery targets.

• Multi-AZ design for compute and data
• Database high availability and read replicas
• Route 53 health checks and failover
• Backup and restore, pilot light, warm standby and active-active
• RTO and RPO as design inputs
• Testing a failure

You build A highly available design with a disaster recovery option and stated recovery targets.

Storage and database choices set the ceiling for performance. You compare object, block and file storage, then match relational, key-value, in-memory and analytics databases to the access pattern.

• S3 storage classes, EBS volume types and EFS
• FSx for specialized file workloads
• RDS and Aurora for relational workloads
• DynamoDB for key-value access at scale
• Caching with ElastiCache and DAX
• Matching a database to an access pattern

You build A storage and database selection for five workloads, with a reason for each.

Compute and network design decide response times. You choose instance families, serverless and containers by workload, and shape traffic with VPC design, content delivery and hybrid connections.

• EC2 instance families and purchasing options
• Lambda and containers by workload type
• VPC design, routing and peering
• CloudFront and Global Accelerator
• Direct Connect and VPN for hybrid access
• Load balancer types and when to use each

You build A compute and network design for a global web application with a stated latency goal.

Data has to arrive and be useful. You choose services to ingest streams and files, transform them, catalog them and query them, so that analysts can reach answers without managing servers.

• Streaming ingestion with Kinesis
• Batch transfer with DataSync and Transfer Family
• ETL with Glue and cataloging
• Querying with Athena and Redshift
• Data lakes and access control with Lake Formation
• Dashboards with QuickSight

You build A data pipeline design from event capture to a queried dashboard.

Cost is a design property, not a finance report. You pick storage tiers, compute purchase options, database sizes and network paths for cost, and set budgets and tags that show where the money goes.

• Storage classes and lifecycle policies
• On-demand, Savings Plans, reserved and Spot compute
• Right-sizing and serverless trade-offs
• Database cost levers
• Data transfer and NAT costs
• Budgets, cost allocation tags and Cost Explorer

You build A cost review of an existing architecture with five changes and their effects.

Design one application and review it against every pillar. You draw the architecture, justify each choice for security, resilience, performance and cost, then revise it after a peer-style review.

• Capturing the requirements
• Drawing and explaining the architecture
• Reviewing it against each pillar
• Estimating its monthly cost
• Revising after feedback

You build A documented three-tier architecture with diagrams, cost estimate and review notes.